GRC Specialist (Information Security, Privacy and Business Continuity)

Role overview

Responsibilities

• Support operation and continuous improvement of information security, privacy, business continuity, and compliance programs.
• Maintain risk and compliance registers, audit trackers, and governance documentation; coordinate ISO 27001, ISO 22301, PDPL, and regulatory compliance initiatives.
• Conduct vendor security, privacy, and business continuity assessments and track remediation.
• Coordinate audit requests, evidence collection, findings, and corrective action follow-up.
• Maintain ROPA, DPIA, privacy incident, BIA, BCP, and disaster recovery records.
• Administer GRC platform users, workflows, dashboards, and reporting.
• Prepare monthly and quarterly reports, KPIs, dashboards, and management presentations.
• Deliver awareness activities and training, and coordinate timely closure of risks, findings, issues, and action plans.

Requirements

• At least 5 years of experience in information security, GRC, risk management, compliance, privacy, business continuity, or a related field.
• Experience supporting ISO 27001, ISO 22301, and PDPL compliance initiatives.
• Experience maintaining risk and compliance registers and governance documentation.
• Hands-on experience coordinating audits, assessments, and evidence management.
• Experience conducting vendor risk and third-party assessments.
• Experience with GRC tools or platforms and management reporting dashboards.
• Strong communication, stakeholder management, and documentation skills.
• Fluency in English and Arabic.

Preferred certifications

• Preferred certifications include CISSP, CISM, CRISC, CGRC, ISO 27001 or ISO 22301 Lead Implementer/Lead Auditor, CIPM, CIPP, CDPSE, and CBCI.